yashsingh1/xdaforums huggingface dataset:
[Xperia Play Android Development] bubblegumballoon:
you dont need root to do this

if you need help then watch my tutorial :)

http://www.youtube.com/watch?v=GaZuKZQoBwA&feature=player_embedded
[Xperia Play Android Development] deepestblue:
No, if you don't mind having two versions of Crash installed!

The US version of crash in that download is from a Verizon phone - it *should* be the same version that you have! There is no need for you to do this, it is only for some from Europe who have an early version of Crash and needed the updated version, that is already on the Verizon phones...

Chris
[Xperia Play Android Development] yifanlu:
Can you get all the information I've listed here? http://xdaforums.com/showpost.php?p=16562748&postcount=306
[Xperia Play Android Development] Dyelon:
Thanks SO much for your quick and polite response!
[Xperia Play Android Development] Dyelon:
Im going to try this right now. How hard is it for a person whos pretty nifty with computers but not a legit hacker programmer?
[Xperia Play Android Development] gojoechris:
Just tried Megaman X4, loads and plays but has serious green flickering and sprite glitches
[Xperia Play Android Development] Yufice:
great work, cool to see this in practice. What makes this a better alternative to PSX emulators (FPse)?
[Xperia Play Android Development] yifanlu:
In theory, since this emulator is made by Sony, it should be better.

In practice however, from the response I'm seeing, it seems like it's not that much better.

But, it's still free and doesn't fpse cost $5?
[Xperia Play Android Development] Yufice:
Oh yeah. I just wasn't sure if this would let the phone just read the .isos or something. either way, good work, i know it wasn't easy. Nice job mang
[Xperia Play Android Development] Dyelon:
I don't understand how to follow the tutorial if I have the newest beta 2 psxperia.

Do I still need java sdk/android sdk?

And yifanlu your readme still says stuff about downloading .jar but you said you don't need it anymore? I'm confused?

Basically, I just downloaded the new beta 2 of your tool and I'm not sure how to get started.
[Xperia Play Android Development] kupo5131:
Ha! Took me about 3 hours but I've cracked it. I now have Ridge Racer Type 4 running very smoothly on the native emulator. Awesome work dude.
[Xperia Play Android Development] yifanlu:
The latest version is pretty easy to use. Just extract all the files to somewhere and double click "psxperiatool-gui.bat" You don't need to install android sdk or have anything in your PATH variable anymore. If the bat file doesn't work, open a command prompt in the folder where the files are and type in "java -jar PSXperiaTool.jar"
[Xperia Play Android Development] Dyelon:
Where exactly is the latest version? just use the download button on your website? and download everything?

I don't see a .bat file.

Also, does JDK or JRK need to be installed?
[Xperia Play Android Development] yifanlu:
You need Java runtime environment, but if you have JDK, that works too. Link's on the first post, https://github.com/downloads/yifanlu/PSXperia/psxperia-beta-2.zip
[Xperia Play Android Development] gwaine:
m3dteam...I tricked the market into thinking I was using a UK sim card and then bought syphon filter. I've since tried yifanlu's tool with syphon filter's apk and everything works great, it installs, then it tells me "Could not authenticate the licensed content. Please purchase it again." when I start the game. I'm thinking maybe this is because I'm using a European version of Syphon Filter (but I did buy the English version FWIW) and a US ISO. Are you using European ISOs? Any tips you could throw my way? Thanks! I tried it with the U.S. Castlevania SOTN and U.S. Nectaris: Military Madness.
[Xperia Play Android Development] yifanlu:
Do they not work with crash bandicoot's apk? Because SOTN works for me.
[Xperia Play Android Development] gojoechris:
FPse has been made to work with (almost) any PSX game, whereas the native emulator only has to support the games Sony sells with it. In time, we should be able to tweak and modify everything within the emulator and have a repository of the changes needed all inside the program you made.
[Xperia Play Android Development] illuminerdi:
It seems like the games that DO work well work pretty good.

I can't get a single game to be even remotely good with FPSE - they either crash or run like garbage, so I'm anxious to try this even if some games don't work at all. I have yet to get a game running as fast and good looking as I'd like it to in FPSE.

Absolute worst case scenario, it gives the FPSE guys some reasons to make their emu better, since this potentially is going to cut into a lot of their sales.
[Xperia Play Android Development] Dyelon:
Got it working. Great job man. Works great within the native emulator.

Tried tony hawk 3. The graphics are insanely messed up, making it unplayable.

The music was perfect though, and would be the major reason I'd use this emulator over FPSE.
[Xperia Play Android Development] Dyelon:
You really think it will be possible to make configurations to get regular ISOs to work better with the native emulator?

That'd be VERY promising.
[Xperia Play Android Development] benpwarner:
Well that sucks!

Can anyone PM me the Crash Bandicoot.apk please? I've never been a big Crash fan and deleted it as soon as I could. If only I knew I'd need it for this.
[Xperia Play Android Development] zero_1_2:
Harvest Moon- Back to Nature: Everything works fine except for a big screen flicker.

Final Fantasy Tactics: Works Perfect as far as ive played

Dino Crisis 1: works perfect

Dino Crisis 2: has weird cinimatic glitches but besides that, runs perfect

Medievil: Works Perfect
[Xperia Play Android Development] gwaine:
Hey Yifanlu...it installed correctly (SOTN). The music and sound are great, but there are graphical glitches that make it unplayable for me. The character you control is a gradiant color (no details on him...just a red to black gradient) and you can't see your health, etc. as it's totally blacked out. I saw that that other guy had a lot of success with Syphon Filter but I ran into that protection thing, I think because the European apk didn't like the US ISOs...could be wrong though. I ripped it as a .bin from my disc.
[Xperia Play Android Development] Dyelon:
that's GREAT to hear....I really hope 90% of games work fine....of course the ONE game I wanted to use this emulator for, Tony Hawk, has absolutely ridiculous graphical glitches lol
[Xperia Play Android Development] Dyelon:
Has anyone tried playing games that don't work well graphic glitch-wise once with the crash.apk and then tried with syphon filter?

Itd be sweet if just switching to syphon filter would help these annoying graphics. I just tried Street Fighter Alpha 3 and I wanted to cry. It ran SO fast, sounded CRISP, even LOOKED amazing....but as soon as fight starts its like the game is having a seizure.
[Xperia Play Android Development] zero_1_2:
someone needs to post the syphon filter "data" folder by creating the folder via the java utility. (siphon filter apk + ZPAK) We could test the new apks using this new version of the psx emulator and post findings.
[Xperia Play Android Development] raza9:
Capcom vs snk pro has graphic glitches tried img and bin file.

Street Fighter Collection 2 img also has graphic glitches.
[Xperia Play Android Development] ebles_q8:
i have tried finalfantasy 7,mgs,parasite eve and crash team racing

non of them work it just crashed when loading
[Xperia Play Android Development] JasonKnight:
maybe because they are multi disk titles?
[Xperia Play Android Development] siuyau01:
Why can't select the buttom?

Why can't select the buttom?
[Xperia Play Android Development] JasonKnight:
Tekken 3 works, Runs around 98% speed pretty steady, havnt noticed any slowdowns.

Also using the American R800x, Used a PAL iso, starting up Crash the boot screen says (SCEA, loading up the PAL game it switched to SCEE)

Sony Computer Entertainment America & Europe.

basically, NTSC and PAL games work. no region lock.
[Xperia Play Android Development] JasonKnight:
did you read the instructions???

check all 4 bottom buttons and

HIGHLIGHT HIS NAME!
[Xperia Play Android Development] yifanlu:
Make an issue post on github with the convert output from the console window and android's logcat when loading. Also make sure you're using the latest version. (Beta 2 update 2).

shhhhhhhh....
[Xperia Play Android Development] siuyau01:
i can use it =.=+so on 9
[Xperia Play Android Development] zero_1_2:
Parapa 1- works fine

Silent hill- Works fine, except for some weird shadows surrounding the character and leaves on trees

Tenchu 1- works perfect

tenchu 2- works amazing
[Xperia Play Android Development] illuminerdi:
Multi disk titles should work fine assuming you're loading disc 1.

In fact most multi disc titles let you save when you finish a disc (all squareenix titles from that era did that i recall) so in theory if you just copy the memcard saves and load a separate apk for disc 2 they should work fine.
[Xperia Play Android Development] JasonKnight:
btw thanks for making it work without the environment variables needed... i put them in where people mentioned they should go and it still didnt work, then i saw you updated the program again ^_^
[Xperia Play Android Development] m3dteam:
Hmmm,

I used Syphon filter, and I playing FF 8, I have to say it is amazing, I did not noticed any graphical glitches.

in FPSA I had trouble watching the intro, with native emulator it was as smooth as the real psx.

I don't know about crash because I could not get it to work. Also, you have to buy the real game. Every time I start a new game I get a license check, but that is ok because I only need to do it once.

You also should be able to play Syphone filter to be able to patch it, or it won't work

oh and yifanlu I will get you the info soon
[Xperia Play Android Development] siuyau01:
How do I solove this problem ?

How do I solove this problem ?
[Xperia Play Android Development] Levistras:
If anybody could PM me a link to their working (with this solution) Crash APK, that would be greatly appreciated.

My canadian model has Crash preloaded, but the CRC32 doesn't match and the solution won't build.

Thanks.
[Xperia Play Android Development] arcticmedia:
Do people even bother to read the OP post it's on the

frontpage

:confused:

Known Bugs

Crash Bandicoot EUR Release 1 does NOT work. If your CB APK file has the CRC32 0x3B6A23C1, it won't work. You can always flash a newer system image to get the newer crash bandicoot apk. For example, this one: http://xdaforums.com/showpost.php?p=16564400&postcount=314
[Xperia Play Android Development] siuyau01:
can't open your link
[Xperia Play Android Development] Dyelon:
That's what I'd like to do. I'll buy it, I don't care. But I'm not rooted and I think I need someone to post the internal memory's data for the game so I can use the tool to make some apks.
[Xperia Play Android Development] JasonKnight:
Metal Gear Solid,

I got it to convert, I got it to install, i got it to start up, and I got to the title screen, no sound on title screen and anything you select takes you to a black screen.
[Xperia Play Android Development] Alexander33:
The tool works perfectly now :) I just tested

Need For Speed Hot Pursuit 3 - First time it froze at loading the race second time worked and the music sucks so i stopeed it ,the sound effects work perfectly,no lags

Mortal Kombat 4 -Everything works perfectly :)

My first game on PC :D
[Xperia Play Android Development] Dyelon:
=( i was hoping this emulator could run some good street fighter games at 100%

trying to play them of fpse leaves alot to be desired
[Xperia Play Android Development] leemarie:
hey guys .

dont like asking for help much ,

i can make apk , installs on phone , when trying to play , comes up with , no content found on sd card , any help would be great thank you

the game im trying is rtype
[Xperia Play Android Development] siuyau01:
would you mind post the apk of Crash Bandicoot ? I would like to test .It is becasue I can't change other game that is my Crash Bandicoot apk file .

THx
[Xperia Play Android Development] Alexander33:
Copy the data folder generated by the tool to /sdcard/Android/
[Xperia Play Android Development] arcticmedia:
did you move the

output

to your sd card ?

you will get a folder called "

output

" when you convert it then open

data

folder in

output

and move "

com.sony.playstation.NCXAxxxxxx_1

" folder to your SD card

Android => Data
[Xperia Play Android Development] leemarie:
hey guys ignore me was being a din

didnt copy the data file

game didnt work just closed on me
[Xperia Play Android Development] :
This is pure awesomesauce!!!

Dual Analog Stick Support FTW!!!!!! Having the games show up in the game launcher is pretty rad as well.

Rayman 2 is freaking awesome with true analog stick support, Rayman runs slower or faster depending on how far my finger is from center like a real analog stick!

Ape Escape, here I come, heres hoping I didnt trash my old psx collection! :P
[Xperia Play Android Development] nextria:
i just bought syphon filter, to check if it works with this game.

But no that i installed it, i cant seem to find the apk in the /system/app/

dir.

Does anyone know where the files go?
[Xperia Play Android Development] leemarie:
crash compilation works fine
[Xperia Play Android Development] Red_Kop:
Whooooo!!!

Coverted my first game with it.

PES 2 appears to work fine (it crashes all the time in FPSE)*

*will have to investigate firther though.

Thanks for the tool, easy process in the end.

The only bad thing about it is the lack of a 'real' save state function but of course this isn't your fault.

Superb, thanks!
[Xperia Play Android Development] Red_Kop:
Hey guys, just wondering about the ZPAK compression.

I converted my 400mb ISO and it is only 30mb as a ZPAK...does it stay like that on the phone or does it extract it?

Because if it doesn't that is uber compressed goodness.
[Xperia Play Android Development] Blagus:
/data/app

BTW, Euro Crash v1 works fine for me.
[Xperia Play Android Development] ashergray:
that was a clever way to check that.
[Xperia Play Android Development] yifanlu:
Unless I'm wrong (which I may as well be), the toc is some kind of license check. Presumably, it also checks random data from the "disk" to see if it's running the right image.ps. I think we have two options 1) see how the check works and try to reproduce it, or 2) patch libdefault.so directly to bypass the checks. From what I can see, the checks only run on boot.

EDIT: I change my mind, it seems like the license check ran before image_ps_toc is decrypted. In fact, it doesn't get decrypted at all if license check fails. It still may be a check to see if the right image.ps is loaded.
[Xperia Play Android Development] Nhialor:
After your success with cracking the Verizon bootloader, why don't you try help yifanlu. Although I'm sure he's more than able to do it himself, the more geniuses helping here the better/faster!
[Xperia Play Android Development] yifanlu:
Ok, I kinda mapped out what libjava-activity does after boot and after license check.

1) Extract, decrypt, and load libdefault.so

2) Same for image_ps_toc

3) Load (uncompressed offset) 0x9300 to 0x12600 (basically, second part of the split-compressed image.ps) of the ISO/Image

4) (Guess) Read stuff like title id and maybe other checks, because that's what's in this section

5) If successful, extract, decrypt and load BIOS

6) Once loaded, start decompressing and reading image.ps (all of it)

Now here's the weird thing. When I changed image.ps (and nothing else) to another game, in this case Crash 3, Step 3 returns garbage data (I'm guessing it's garbage because I can't find the data anywhere else, and it looks like zlib error data from past experiences). Now I'm guessing maybe image_ps_toc does something weird to the compressed version of this data to make it decompress to garbage.

More interesting things:

* Replacing uncompressed offset 0x9300 -> 0x12600 of Crash 3 with Crash 1's image still returns the same garbage data

* Replacing uncompressed offset 0x0 -> 0x12600 of Crash 3 with Crash 1's image allows the game to run, but crashes because, well, the image is corrupted. But it does run.

* Just to double check and clarify, the breaks in the compressed version of offsets for 0x0 -> 0x12600 matches, so it's not as simple as trying to decompress from the wrong location.

This means that the check is 1) inside image_ps_toc, 2) does something with the first 0x9300 bytes and the second 0x9300 bytes, and if something goes wrong, there is zlib returns garbage (so it does something to the compressed version).

This also means that if you can "trick" the emulator to read the first 0x12600 bytes from Crash from the check and then quickly swap the file, you can run any image. But this isn't good enough. I want to see what the toc file stores that makes it do this :/

EDIT 2: Here's the format of the TOC file

0x8 byte header (I think)

0x4 byte sections

->0x2 bytes ?????

->0x2 bytes location in little endian I think

The location is what I think because the first few sections have "0000", and then a few "0001", all the way to "20B5". It's in order, but there is not a set amount of each set. For example, there are 10 sets that have "0000" for location, but 2 for "0001" and one for "0004". It's mostly one to three sets.
[Xperia Play Android Development] ashergray:
If it is tossing out garbage when you change games is it possible then that the TOC and the image_ps_toc are the encryption keys.

Or perhaps they hold the information about the image ie. size, name, and maybe other things as well, so the response your getting is because they do not match with the image you have replaced it with.

here is something worth trying: replace the image with another crash bandicoot image and see if it works that way, if it doesnt and that was the only thing that has changed it maybe tied to the system in some manner.

edit: let me know if you want my crash image to work with. its a free game with the system so it shouldnt be a problem to share it.
[Xperia Play Android Development] yifanlu:
I've made a huge mistake.

Remember when I said, I checked and made sure the pointer in the compressed data matches? Well, I checked again, and they don't. In fact, it's trying to load from the same pointer in compressed Crash 1's 0x9300 -> 0x12600 in the Crash 3 image. So, I'm going to try to fix that and report back.

Hmm. Weird. 1D7E is the offset in the compressed image, and the following entry exists in the TOC: "7E1D0000" 1D7E => 0000 (???) I looked at some other entries, ex "14000000" 0014 is the location of the first entry. I think it's a red herring though because none of the other entries work.
[Xperia Play Android Development] yifanlu:
I'm looking at the source for PSX emulators. This seems relevant.

typedef struct
{
unsigned char reserved1;
unsigned char cAdrCtrl;
unsigned char cTrackNum;
unsigned char reserved2;
unsigned long lAddr;
} TOC_TRACK;

typedef struct
{
unsigned short usTocDataLen;
unsigned char cFirstTrack;
unsigned char cLastTrack;
TOC_TRACK tracks[100];
} TOC, *PTOC, FAR *LPTOC;
[Xperia Play Android Development] gwaine:
Hey Yifanlu...thanks for all of your efforts in trying to get this figured out!
[Xperia Play Android Development] nscxp2005:
Great work yifanlu

Keep going at it. I'm sure you will manage to crack this emulator.

All the best,

NSCXP2005
[Xperia Play Android Development] yifanlu:
I know for sure that uncompressed offset 0x1C of the TOC file contains a two byte offset for the compressed image.ps that is read. However, I still have no idea what the format for the rest is.

Right now, I'm trying to modify libjava-activity.so to load unencrypted files so I can modify the TOC file. It might take a while because it was designed not to be reverse engineered.

EDIT:

Wow, who knows that a night's rest will reveal the obvious. It seems that the TOC file IS a table of contents. I was just reading it wrong. I was splitting it into two byte sections when it was in fact four byte sections (long). I've figured out most of the file's format.

0x0 -> 0x4: Magic number/header, always 04000000

0x4 -> 0x18: Unknown (size? checksum? key?)

0x18 -> end: entries of the offsets of each "segment" in the image.ps file. Little endian. 8 bytes each.

Now I just need to find out what the unknown 20 bytes are and I can reconstruct the image toc file. After that I need to get libjava-activity to load unencrypted files. Then everything will work, I'm sure of it.

EDIT 2:

0x14 to 0x18 is the number of entries

I think 0x8 to 0x14 are constant for single disked games. Maybe they store offsets for different disks?
[Xperia Play Android Development] ashergray:
Lol I told you it was a table of contents. Keep up the hardwork.

sent from the original unlocked R800X.
[Xperia Play Android Development] yifanlu:
When I first saw "TOC" I was like "table of contents", but then I though "nah, that would be too obvious." Well, I guess I was wrong.

Also, bytes 0x4 to 0x8 is the uncompressed size of the image. The TOC file is now completely analyzed and reproducible. We're now like 90% of the way there. The only thing to do now is to patch libjava-activity to accept decrypted files (so we can use modified versions of them).

If anyone is good at ARM Assembly, please contact me. I mean you need to be VERY good. I'm thinking of overwriting an entire function to load data from a file instead of from memory.

EDIT: Here's the current plan. I'm going to re-write libjava-activity from scratch in C++ to load everything decrypted. This will take some time, so if anyone has a better idea. Here's what I need. First of all, the only thing that needs to be loaded decrypted is image_ps_toc. This is not as simple as modifying the binary to bypass decryption as the size of image_ps_toc is different for each image, so I cannot replace the data in libjava-activity. I need to disassemble, modify data, and reassemble for each and every game. That would be just as much trouble as rewriting the whole thing. Another way would be to write some kind of preloader that modifies the toc file in memory when the emulator is loaded. This will most likely require a rooted phone, and would also take a while to write. I think the safest bet would be to rewrite libjava-activity, as the only thing it does is load libdefault and some other stuff.
[Xperia Play Android Development] Larry94:
I'm not sure you are familier with the Playstation Portable hacking scene, but this is exactly what happened. Someone took the Native POPS by sony and cracked it to run unauthorized eboots. (POPS= Psx On PSP)

Maybe you should take a look around in the POPS Loader released in the PSP Hacking scene?
[Xperia Play Android Development] yifanlu:
I have a PSP, but this is entirely different. Also, I've already cracked it as of today. All files are decrypted and I've completely analyzed it to figure out how it all works. The only problem now is putting everything back together again.
[Xperia Play Android Development] Scorbion:
Nice work m8

If you need anything, i'm ready :D
[Xperia Play Android Development] yifanlu:
Ok, I got the plan ready, what I want to write is sort of a preloader. This library, I will call libjava-activity.so and when the dalvik app loads libjava-activity.so, my library will be loaded instead of sony's. My library will load Sony's into memory and then overwrite GetImageToc and GetImageTocLength functions to use a decrypted file instead of from memory. In addition, java needs to be tricked into seeing the functions from sony's library and not return a java.lang.UnsatisfiedLinkError.

It will take a while, so if there are any C/JNI programmers out there that know what I'm talking about, I would appreciate the help.

(The reason I gave up on the "rewriting the entire library" thing was because in order for that to work, you need an decrypted version of all the files, but I can't distribute that and it is too complicated to ask every user to extract it themselves)
[Xperia Play Android Development] Nhialor:
I know basic java and do understand what you are saying but I don't think if be much help tbh.